A vehicle is equipped with a controller called to as electronic control unit (ECU). Detecting the states of a switch or an output of a sensor on the vehicle, the ECU controls supplying power from a power supply to a load (electric component) corresponding to the switch, the sensor, or the like in accordance with the above detecting result. As numerous loads, switches, sensors, and the like are usually mounted on a vehicle, it is also equipped with a plurality of ECUs correspondingly.
In a vehicle, meanwhile, there is performed a control where a power supply line connected to a power supply is interrupted if a current flowing through the power supply line exceeds a threshold value, by a monitoring unit for monitoring power supply systems as a whole. By this control, it is possible to prevent the occurrence of an overcurrent state on a route for supplying a power of the power supply, thereby preventing an electric wire from being damaged. The threshold value for this control is established on the basis of a maximum current flowing through the power supply line. Further, if the power supply line is provided for respective ECUs, then the maximum current for the power supply line is determined on the basis of the sum of respective currents flowing through the respective ECUs.
Here, there is a situation where the power supply control of an ECU for a load becomes unnecessary depending on the condition of a vehicle, for example, the position of an ignition switch. Therefore, when the power supply control for the load is unnecessary with respect to all objects to be controlled, it is possible for the ECU to make the transition of its own operating condition from a startup state (wake state) to a power saving state (sleep state) in view of power saving.
As for a power that an ECU does consume, there is a difference in between the startup state and the power saving state. An ECU in the power saving state consumes a power less than the ECU in the startup state. Therefore, by checking whether or not the magnitude of a current flowing through the power supply line against an ECU actually is a value compatible to the fundamental and original state for the ECU, it is possible to detect an anomaly that the ECU still remains in the startup state despite of being supposed to be in the power saving state.
However, a current flowing through the power supply line when an ECU is in the power saving state is originally smaller than a current flowing when the ECU is in the startup state due to reduction in number of loads supplied with power under the control of ECUs. Therefore, only with the occurrence of an anomaly that an ECU supposed to make the transition to the power saving state has not made the transition to the power saving state yet, the current flowing through the power supply line does not produced such a variation as to exceed a threshold value suitable to detect an overcurrent condition when the ECU is in the startup state.
Thus, for instance, in a case of monitoring the occurrence of an overcurrent condition when an ECU is in the startup state and also the occurrence of an anomaly of the ECU when it is supposed to be in the power saving state, when the ECU is in the power saving state, it is necessary to switch the threshold value used for the comparison with the current flowing through the power supply line to a lower value than the threshold value when the ECU is in the startup state.
Therefore, there is proposed a technique where each ECU of a vehicle makes a declaration of operating condition of its own to the monitoring unit through a communication periodically, while the monitoring unit renews the threshold value on the ground of the declaration periodically (refer to JP 2009-081948 A). According to this proposal, it is possible to switch the threshold value of the monitoring unit corresponding to the operating condition of the ECU.
Then, by switching the threshold value and also providing the monitoring unit for monitoring the current flowing through the power supply line, it is possible to detect an anomaly, which may be caused under condition that a current flowing through the power supply line is smaller than a current in case of an anomaly where an overcurrent state arises in an ECU in a startup state, for example, such an anomaly that an ECU does not change from its startup state to the power saving state.
The capability to detect such an anomaly enables an ECU, which is supposed to change to the power saving state by e.g. turning off an ignition switch, to be interrupted from a power supply in advance of such a situation that, if the ECU keeps its clock operation under the startup state due to program runaway etc., a power of the power supply incapable of being charged due to an engine stopping would be consumed by the ECU uselessly. This is a remarkably effective measure in view of avoiding the occurrence of a situation where an engine cannot be started by a starter due to battery exhaustion.